PT-2018-14046 · Teltonika · Teltonika Rut9Xx

David Gnedt · Published 2018-10-15 · Updated 2019-10-03 · CVE-2018-17534

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Teltonika RUT9XX routers with firmware prior to 00.04.233

Description The issue allows attackers with physical access to the device to execute arbitrary commands with root privileges due to a lack of proper access control on the root terminal provided on a serial interface.

Recommendations For Teltonika RUT9XX routers with firmware prior to 00.04.233, update the firmware to version 00.04.233 or later to address the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-17534

Affected Products

Teltonika Rut9Xx

References · 5

• 🔥 https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180319-02_Teltonika_Incorrect_Access_Control · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Oct/28 · Exploit
• 🔥 http://packetstormsecurity.com/files/149779/Teltonika-RUT9XX-Missing-Access-Control-To-UART-Root-Terminal.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-17534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17534 · Security Note